privateer-agent 0.6.3 → 0.6.4

package/README.md

@@ -248,6 +248,21 @@ redactor before it leaves.
 Switch with **`/mode`**. Even in `bypass`, a danger filter blocks destructive shell commands,
 and protected files (`.env`, shell rc files…) are guarded — the gate is never fully off.
 
+### `--no-quarter` — lower the moat entirely
+
+For an unattended run in a directory and on a task you fully trust, launch with:
+
+```bash
+privateer --no-quarter
+```
+
+This is the one exception to "the gate is never fully off." It disables the permission
+gate for the **whole session** — every action auto-approves with no prompt, including
+destructive shell commands, out-of-cwd access, and protected files. Subagents spawned
+by the session inherit it. There is no `/mode` equivalent; it's a deliberate launch-time
+opt-out (env `PRIVATEER_NO_QUARTER=1`) and prints a red warning banner so it's never a
+surprise. Use it sparingly.
+
 ## Extend it
 
 Everything below is a **Pi extension** loaded by discovery (see [Built on Pi](#built-on-pi)) —

package/bin/privateer-launch.mjs

@@ -41,6 +41,29 @@ const NODE_BIN = BUNDLED ? bundledNode : process.execPath;
 process.env.PATH = path.dirname(NODE_BIN) + path.delimiter + (process.env.PATH || "");
 
 const args = process.argv.slice(2);
+
+// `--no-quarter` — total permission bypass ("take no prisoners"). Strip it from the
+// args BEFORE anything else so it never reaches Pi's cli.js (which doesn't know it)
+// and so `sub`/`args.slice(1)` see only real subcommands. When present we export
+// PRIVATEER_NO_QUARTER=1; the permission gate (extensions/privateer-gate.ts, and any
+// subagent child that inherits this env) then auto-approves EVERY action with no
+// prompt — dangerous shell, destructive tools, out-of-cwd, protected files, all of
+// it. This is the moat fully lowered; only pass it when you trust the whole session.
+const NO_QUARTER = args.some((a) => a === "--no-quarter");
+if (NO_QUARTER) {
+  for (let i = args.length - 1; i >= 0; i--) if (args[i] === "--no-quarter") args.splice(i, 1);
+  process.env.PRIVATEER_NO_QUARTER = "1";
+  process.stderr.write(
+    [
+      "",
+      "  ⚓ \x1b[1;31mNo quarter\x1b[0m — permission gate DISABLED for this session.",
+      "     Every action (shell, edits, destructive tools, out-of-cwd) runs WITHOUT a prompt.",
+      "     Only use this in a directory and with a task you fully trust.",
+      "",
+    ].join("\n") + "\n",
+  );
+}
+
 const sub = args[0];
 
 // `privateer --version` — report OUR version, not Pi's. Left to Pi's cli.js it would
@@ -169,17 +192,41 @@ else {
   // TEE, strongest tier) when a Tinfoil key is present; else the signed-in account's
   // NEAR channel; else a cheap OpenRouter fallback.
   const CRED = path.join(PRIVATEER_HOME, "credentials.json");
+  const signedIn = fs.existsSync(CRED);
   const MODEL = process.env.PRIVATEER_MODEL
     ? process.env.PRIVATEER_MODEL
     : haveTinfoilKey()
       ? "tinfoil/glm-5-2"
-      : fs.existsSync(CRED)
+      : signedIn
         ? "privateer/near/zai-org/GLM-5.1-FP8"
         : "openrouter/openai/gpt-4o-mini";
 
+  // Guard the keyless dead-end. We land on the OpenRouter fallback ONLY when the user
+  // named no model, has no Tinfoil key, AND isn't signed in (no credentials.json). If
+  // they also have no OpenRouter/other BYO key, the very first prompt errors with a bare
+  // "No API key found for openrouter" and nothing explains why. Worse, if this machine
+  // was signed in before (other ~/.privateer state exists but the login file is gone),
+  // that bare error hides a vanished session. Surface a clear, branded notice BEFORE the
+  // TUI loads — but still boot it, so `/login` inside works (and activateSignedInModel
+  // switches the live session onto the account channel the moment they sign back in).
+  if (MODEL === "openrouter/openai/gpt-4o-mini" && !haveByoKey()) {
+    warnKeylessLaunch();
+  }
+
+  // Privateer's own bundled skills. Loaded by explicit path (Pi's `--skill`, which
+  // takes a file or directory) rather than seeded into the agent dir, so they load
+  // read-only from the shipped release — always matching this version, never
+  // clobbering or resurrecting anything in the user's own editable skills dir. Each
+  // is a directory holding a SKILL.md. Skip any that aren't present (e.g. a partial
+  // dev checkout) so a missing dir can't wedge launch.
+  const SKILL_DIRS = ["resolve-dependencies"]
+    .map((name) => path.join(REPO, "skills", name))
+    .filter((dir) => fs.existsSync(dir));
+  const skillArgs = SKILL_DIRS.flatMap((dir) => ["--skill", dir]);
+
   // Dev convenience: load provider keys from the repo's .env if present.
   const nodeArgs = fs.existsSync(ENV_FILE) ? [`--env-file=${ENV_FILE}`] : [];
-  runToCompletion(NODE_BIN, [...nodeArgs, CLI, "--model", MODEL, ...args]);
+  runToCompletion(NODE_BIN, [...nodeArgs, CLI, "--model", MODEL, ...skillArgs, ...args]);
 }
 
 // --- helpers ---------------------------------------------------------------
@@ -240,11 +287,62 @@ function findWindowsBash() {
 }
 
 function haveTinfoilKey() {
-  if (process.env.TINFOIL_API_KEY) return true;
-  try { return /^TINFOIL_API_KEY=.+/m.test(fs.readFileSync(ENV_FILE, "utf8")); }
+  return haveKey("TINFOIL_API_KEY");
+}
+
+// True if `name` is set in the environment or (dev convenience) present and non-empty in
+// the repo .env — the same two sources the child inherits, so this matches what Pi will
+// actually see for the provider key at request time.
+function haveKey(name) {
+  if (process.env[name]) return true;
+  try { return new RegExp(`^${name}=.+`, "m").test(fs.readFileSync(ENV_FILE, "utf8")); }
   catch { return false; }
 }
 
+// Any BYO provider key that would make the keyless OpenRouter launch model usable (or at
+// least give the runtime SOME working provider). Mirrors defaultModel.ts's BYO_BY_KEY.
+function haveByoKey() {
+  return ["OPENROUTER_API_KEY", "ANTHROPIC_API_KEY", "OPENAI_API_KEY", "TINFOIL_API_KEY"]
+    .some(haveKey);
+}
+
+// Explain the keyless launch instead of letting the first prompt dead-end on a bare
+// "No API key found for openrouter". Distinguishes a returning user whose login file is
+// missing (other ~/.privateer state exists → likely signed out unexpectedly) from a
+// genuine first run. Non-fatal: we print and carry on so `/login` inside still works.
+function warnKeylessLaunch() {
+  // Heuristic "was signed in before": the agent dir or our own config.json exists even
+  // though credentials.json doesn't. A true first run has neither yet.
+  let returning = false;
+  try {
+    returning =
+      fs.existsSync(path.join(PRIVATEER_HOME, "agent")) ||
+      fs.existsSync(path.join(PRIVATEER_HOME, "config.json"));
+  } catch { /* best-effort — default to the first-run wording */ }
+
+  const lines = returning
+    ? [
+        "",
+        "  ⚓ Your Privateer login is missing — this terminal isn't signed in.",
+        `     (no ${path.join(PRIVATEER_HOME, "credentials.json")})`,
+        "",
+        "  If you were signed in before, your session was cleared. Run /login to sign",
+        "  back in — you'll return to your subscription models right away. Until then,",
+        "  prompting fails with \"No API key found\" because no model key is set.",
+        "",
+      ]
+    : [
+        "",
+        "  ⚓ You're not signed in to Privateer and no provider API key is set.",
+        "",
+        "  Run /login to use your subscription, or set a provider key (e.g.",
+        "  ANTHROPIC_API_KEY / OPENAI_API_KEY / OPENROUTER_API_KEY). Until then,",
+        "  prompting fails with \"No API key found\".",
+        "",
+      ];
+  process.stderr.write(lines.join("\n") + "\n");
+}
+
 function refreshUpdateCache() {
   const cache = path.join(PRIVATEER_HOME, "update-check.json");
   try {

package/extensions/privateer-gate.ts

@@ -353,6 +353,10 @@ const gate = makePermissionGate({
   localAsk,
   getRemote: bridge.getRemote,
   getNoQuarter: bridge.getNoQuarter,
+  // `--no-quarter` at launch (see bin/privateer-launch.mjs) sets PRIVATEER_NO_QUARTER
+  // and opts this whole session — TUI and any subagent children that inherit the env —
+  // out of the gate entirely: every action auto-approves, no prompt.
+  getSkipAllPermissions: () => process.env.PRIVATEER_NO_QUARTER === "1",
   remoteAsk: bridge.remoteAsk,
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.6.3",
+  "version": "0.6.4",
   "description": "Privateer — a provider-agnostic, safe-by-default terminal coding agent with TEE/Tinfoil attestation, rebuilt on the Pi toolkit. Bring your own model across 20 providers.",
   "type": "module",
   "license": "MIT",
@@ -37,6 +37,7 @@
     "bin",
     "src",
     "extensions",
+    "skills",
     "patches",
     "README.md",
     "LICENSE"

package/patches/@earendil-works+pi-coding-agent+0.80.3.patch

@@ -1,3 +1,23 @@
+diff --git a/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js b/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js
+index e223ce1..2bdab10 100644
+--- a/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js
++++ b/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js
+@@ -711,6 +711,15 @@ export class AgentSession {
+                 finalError: msg.errorMessage,
+             });
+             this._retryAttempt = 0;
++            // Privateer patch: a transient error that survived the full retry budget
++            // is terminal. Ending the turn here (instead of falling through to
++            // compaction / queued-message continuation) prevents the agent loop from
++            // re-entering agent.continue(), hitting the identical error, and — because
++            // the retry counter was just reset to 0 — starting a fresh burst of 3.
++            // That re-entry is what produced the endless "retrying 1/3…2/3…3/3" loop
++            // on a persistently-failing provider/tool. Context-overflow errors never
++            // reach this branch (_isRetryableError → false), so compaction is untouched.
++            return false;
+         }
+         if (await this._checkCompaction(msg)) {
+             return true;
 diff --git a/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/interactive-mode.js b/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/interactive-mode.js
 index 5d65200..a997ad7 100644
 --- a/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/interactive-mode.js

package/skills/resolve-dependencies/SKILL.md

@@ -0,0 +1,103 @@
+---
+name: "resolve-dependencies"
+description: "Resolve a missing system binary/CLI tool or language package (npm/pip/cargo/go/gem) in the current environment. Use when a command fails with 'command not found', a build/test fails on a missing tool, or code fails on an unresolved import/module. Detects the right package manager, prefers a user-writable install, and runs the concrete install command through the permission gate."
+---
+
+# Resolving missing dependencies
+
+When work is blocked because a **system tool** (e.g. `ripgrep`, `jq`, `cmake`) or a
+**language package** (e.g. `zod`, `requests`, `serde`) is not installed, resolve it
+deliberately. You are running on the user's own machine — installs are real and
+persist — so pick the smallest, least-privileged command that unblocks the task and
+let the user approve it.
+
+Never install silently to "just make it work." Confirm what's missing, choose the
+narrowest install, and run it through the normal `bash` tool so the permission gate
+shows the user the exact command. Do not pipe remote scripts into a shell
+(`curl … | sh`) — the gate flags that as dangerous and it is rarely the right way to
+get a dependency.
+
+## 1. Confirm it's actually missing
+
+Before installing anything, verify the gap:
+
+- System tool: `command -v <tool>` (or `which <tool>`). Empty output → missing.
+- Language package: check the project manifest first (`package.json`,
+  `requirements.txt` / `pyproject.toml`, `Cargo.toml`, `go.mod`, `Gemfile`). If the
+  package is already declared, the fix is usually **install project deps**
+  (`npm install`, `pip install -r requirements.txt`), not adding a new one.
+
+If a tool is missing only for this one command, consider whether an already-present
+alternative works (e.g. `rg` → `grep -r`, `jq` → a small `node`/`python` one-liner)
+before installing.
+
+## 2. Detect the right package manager
+
+**Language packages** — pick from the manifest that exists in the project (do not
+guess the ecosystem):
+
+| Manifest present            | Add a package                               | Install declared deps            |
+| --------------------------- | ------------------------------------------- | -------------------------------- |
+| `package.json`              | `npm install <pkg>` (or `pnpm add`/`yarn add` if that lockfile is present) | `npm install`                    |
+| `requirements.txt`          | `pip install <pkg>`                         | `pip install -r requirements.txt`|
+| `pyproject.toml` (Poetry)   | `poetry add <pkg>`                          | `poetry install`                 |
+| `pyproject.toml` (uv)       | `uv add <pkg>`                              | `uv sync`                        |
+| `Cargo.toml`                | `cargo add <pkg>`                           | `cargo build`                    |
+| `go.mod`                    | `go get <pkg>`                              | `go mod download`                |
+| `Gemfile`                   | `bundle add <pkg>`                          | `bundle install`                 |
+
+Match the lockfile, not just the manifest: `pnpm-lock.yaml` → use `pnpm`,
+`yarn.lock` → `yarn`, `bun.lockb` → `bun`. Adding a package edits the manifest —
+that's usually wanted, but say so if the user only asked to run something.
+
+**System binaries** — detect the OS package manager by probing, in order, and use the
+first one available:
+
+| `command -v` hit | Install command                    | Notes                              |
+| ---------------- | ---------------------------------- | ---------------------------------- |
+| `brew`           | `brew install <pkg>`               | macOS/Linuxbrew — no sudo, preferred |
+| `apt-get`        | `sudo apt-get install -y <pkg>`    | Debian/Ubuntu; run `apt-get update` first if the install 404s |
+| `dnf` / `yum`    | `sudo dnf install -y <pkg>`        | Fedora/RHEL                        |
+| `apk`            | `apk add <pkg>` (`sudo` if needed) | Alpine                             |
+| `pacman`         | `sudo pacman -S --noconfirm <pkg>` | Arch                               |
+| `nix-env`        | `nix-env -iA nixpkgs.<pkg>`        | Nix — no sudo                      |
+| `zypper`         | `sudo zypper install -y <pkg>`     | openSUSE                           |
+
+The package name is not always the command name (e.g. the `fd` command ships as
+`fd-find` on apt, `fd` on brew). If unsure of the exact package name, use the
+`web_search` / `web_fetch` tools to confirm it for the detected package manager
+before running the install.
+
+## 3. Prefer the least-privileged install
+
+- Reach for a **no-sudo** manager first (`brew`, `nix`, language package managers)
+  before a system one that needs `sudo`.
+- For language packages outside a project, prefer a **user or isolated install**
+  over a global one:
+  - Python: a virtualenv (`python -m venv .venv && . .venv/bin/activate`) or
+    `pip install --user <pkg>` rather than a system-wide `sudo pip`.
+  - Node CLIs you only need to run once: `npx <pkg>` instead of `npm install -g`.
+- Only escalate to `sudo` / system-wide when there is no user-writable option and the
+  task genuinely needs it. Explain why in the same message so the user's approval is
+  informed.
+
+## 4. Run it and verify
+
+Run the chosen command via the `bash` tool (never fabricate success). The permission
+gate will surface the exact command to the user — that is intended, so keep the
+command to the single thing you need.
+
+After it completes:
+
+1. Re-check availability (`command -v <tool>`, or re-run the failing import/build).
+2. Retry the original task.
+3. If the install was denied or failed, **stop and tell the user** what's missing and
+   the command you would run — do not loop on variants of the same install.
+
+## Notes
+
+- If the environment looks locked-down (read-only filesystem, no package manager
+  found, no network), say so plainly and ask how the user wants to proceed rather than
+  hunting for a workaround.
+- One dependency at a time when debugging a broken environment — install, verify,
+  then move on — so a failure is easy to attribute.

package/src/cli/chat.ts

@@ -281,6 +281,8 @@ async function main() {
     },
     getRemote: bridge.getRemote,
     getNoQuarter: bridge.getNoQuarter,
+    // `--no-quarter` at launch (env PRIVATEER_NO_QUARTER) → total gate bypass, no prompts.
+    getSkipAllPermissions: () => process.env.PRIVATEER_NO_QUARTER === "1",
     remoteAsk: bridge.remoteAsk,
     // Subagents (and their child-only intercom tools) can't be driven from the app
     // yet — pi-subagents runs each in a child session whose gate/UI bypass the relay,

package/src/ext/permissionGate.ts

@@ -44,6 +44,10 @@ export interface GateController {
   confineToCwd?: boolean;
   getRemote?(): boolean;
   getNoQuarter?(): boolean;
+  // Total bypass — see ModeGate.getSkipAllPermissions. Set by the `--no-quarter`
+  // launch flag (env PRIVATEER_NO_QUARTER); when true the gate auto-allows every
+  // action with no prompt.
+  getSkipAllPermissions?(): boolean;
   // Block a tool outright while the turn is remote-driven (only consulted when
   // getRemote() is true). For tools whose own prompts render on the host terminal
   // rather than the relay — e.g. pi-subagents — so a driven turn can't wedge on an
@@ -132,20 +136,26 @@ export async function decideToolCall(
     ask,
     getRemote: ctrl.getRemote,
     getNoQuarter: ctrl.getNoQuarter,
+    getSkipAllPermissions: ctrl.getSkipAllPermissions,
   });
 
   let decision: "allow" | "deny";
   try {
     decision = await withTimeout(gate.request(req), ctrl.approvalTimeoutMs, ctx.signal);
   } catch (err) {
-    // Fail closed: a thrown/aborted/timed-out approval blocks the tool.
+    // Fail closed: a thrown/aborted/timed-out approval blocks the tool. Phrase it
+    // as terminal — re-issuing the identical call will hit the same closed gate, so
+    // tell the model to stop retrying and take a different path (or ask the user).
     return {
       block: true,
-      reason: `Approval unavailable (${(err as Error)?.message ?? "error"}) — blocked by default`,
+      reason: `Approval unavailable (${(err as Error)?.message ?? "error"}) — blocked by default. Do not retry the same command; it will be blocked again. Try a different approach or ask the user to run it.`,
     };
   }
   if (decision === "deny") {
-    return { block: true, reason: `${req.title} denied by permission gate` };
+    return {
+      block: true,
+      reason: `${req.title} was denied by the permission gate. Do not retry the same command; it will be denied again. Take a different approach or ask the user to run it themselves.`,
+    };
   }
   return undefined;
 }

package/src/permissions/modeGate.ts

@@ -34,6 +34,13 @@ export interface ModeGateDeps {
   // pinging the phone. Dangerous shell and alwaysAsk-destructive actions rank
   // above bypass in decideAuto, so those still relay for an explicit Allow/Deny.
   getNoQuarter?: () => boolean;
+  // True when the operator launched with `--no-quarter` (env PRIVATEER_NO_QUARTER):
+  // a session-wide TOTAL bypass of the gate. Every request auto-approves — including
+  // dangerous shell, destructive tools, out-of-cwd and protected-file access — with
+  // no prompt, local or remote. This sits ABOVE everything else (mode, allowlist,
+  // the remote branch, even the dangerous-command denylist): the operator has
+  // explicitly opted the whole session out of the moat. Off unless the flag is set.
+  getSkipAllPermissions?: () => boolean;
 }
 
 // The permission gate used by the live TUI. It first applies the mode/allowlist
@@ -43,6 +50,13 @@ export class ModeGate implements PermissionGate {
   constructor(private readonly deps: ModeGateDeps) {}
 
   async request(req: PermissionRequest): Promise<PermissionDecision> {
+    // No-quarter: the operator launched with `--no-quarter`, opting the whole
+    // session out of the gate. Total bypass — auto-allow EVERY request (dangerous
+    // shell, destructive tools, outside-cwd, protected files) with no prompt, before
+    // any mode/allowlist/remote/denylist policy is consulted. Deliberately the very
+    // first check so nothing below can force an "ask" back on.
+    if (this.deps.getSkipAllPermissions?.()) return "allow";
+
     const denylist = this.deps.denylist ?? [];
     const auto = decideAuto(req, this.deps.getMode(), this.deps.allowlist, denylist);